Closed VakarisZ closed 3 months ago
All modified and coverable lines are covered by tests :white_check_mark:
Project coverage is 77.08%. Comparing base (
f829392
) to head (7223815
). Report is 21 commits behind head on develop.
:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.
I've fixed the config, but by practice and according to the CVE this version is not vulnerable:
# OpenSMTPD after commit a8e222352f and before version 6.6.2 does not adequately
# escape dangerous characters from user-controlled input.
The debian version seems to be close, but I'm getting some errors about missing dependencies:
googlecompute.opensmtpd-68: fatal: [default]: FAILED! => {"msg": "Unable to encrypt nor hash, passlib must be installed. No module named 'passlib'. Unable to encrypt nor hash, passlib must be installed. No module named 'passlib'"}
I'm not sure how much longer it would take to fix, so I'll drop it for now as it's not a priority
Useful resources
To debug further you can use the deployed VM opensmtpd-66.
su vakaris_zilius
thenhistory
.Mainly, the code required should already be in
envs/monkey_zoo/packer/tasks/linux_setup_opensmtpd.yml
, but it's not tested there might be bugs. You can also use this tutorial which will get you most of the way, but the contents of config files should be taken fromopensmtpd-66
machine.Once the image is built, you can use this to test if the exploit works